Pwn2Own 2013 Contest – Samsung Galaxy S4 and iPhone 5 0-day exploits

Pierluigi Paganini November 15, 2013

At last HP’s Pwn2Own 2013 contest hacking teams from Japan and China compromised iPhone 5 running iOS 6 and iOS 7 and a Samsung Galaxy S4.

During the last HP’s Pwn2Own 2013 contest at Information Security Conference PacSec 2013 in Tokyo, two teams of Chinese and Japanese hackers demonstrated the exploitation of zero-day vulnerability in Apple’s Safari browser for the iPhone 5 running iOS 6 and iOS 7 and the Samsung Galaxy S4.

The Pwn2Own contest is organized is to attract hackers into legitimate circles trying to keep them out of the black market.

During the Pwn2Own 2013 contest the Japanese Team MBSD, of Mitsui Bussan Secure Directions, Inc. won $40,000 reward for zero day exploit demonstrating also several exploits against default applications on the Samsung Galaxy S4.

pwn2own contest 2013

The zero-day allows the attacker to compromise the mobile device in several ways, for example using a drive-by download to install malware on the Smartphone.

“This team exploited multiple apps, installed by default on the Samsung Galaxy S4 to install malware and steal confidential data. In order for the exploit to be successful, the affected user must first be lured to an attacker-controlled malicious website. However, from there, no more user interaction is required and an attacker can install arbitrary applications of their choice with system-level privileges on the user’s device. In this case, the payload was the capture and exfiltration of sensitive data including the affected user’s contacts, bookmarks, browsing history, screen shots, SMS messages, etc.”
The attack conducted by the group at Pwn2Own 2013 allowed hackers to gain system-level privileges on the device and to instal applications designed to gather information, including SMS messages, contacts and browsing history.
The second team of white hat Hackers from Keen Cloud Tech in China explained how to exploit a vulnerability in recent IOS ver. 7.0.3 To steal Facebook credentials and a photo of a device running IOS 6.1.4. The prize money for them is $27,500, and it is the first ever Chinese team to win a Pwn2Own competition.

It must be specified that both attacks would require user interaction despite for no more than five minutes.
Samsung and Apple have been already alerted on the zero-day vulnerabilities and the exploits used by the hackers.

Pierluigi Paganini

(Security Affairs – Pwn2Own 2013 Contest, hacking mobile)



you might also like

leave a comment